================================================================== BUG: KASAN: use-after-free in kobject_put+0x220/0x270 lib/kobject.c:748 Read of size 1 at addr ffff88809e1ce63c by task syz-executor.1/8460 CPU: 1 PID: 8460 Comm: syz-executor.1 Not tainted 5.9.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x198/0x1fd lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 kobject_put+0x220/0x270 lib/kobject.c:748 delete_partition+0x134/0x220 block/partitions/core.c:324 bdev_del_partition+0x18b/0x1d0 block/partitions/core.c:549 blkpg_do_ioctl+0x2d6/0x330 block/ioctl.c:33 blkpg_ioctl block/ioctl.c:69 [inline] blkdev_ioctl+0x58a/0x700 block/ioctl.c:589 block_ioctl+0xf9/0x140 fs/block_dev.c:1871 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45d5b9 Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f54179aac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000008c40 RCX: 000000000045d5b9 RDX: 0000000020000000 RSI: 0000000000001269 RDI: 0000000000000003 RBP: 000000000118cf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c R13: 00007ffda5553abf R14: 00007f54179ab9c0 R15: 000000000118cf4c Allocated by task 8459: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461 kmem_cache_alloc_trace+0x174/0x2c0 mm/slab.c:3550 kmalloc include/linux/slab.h:554 [inline] kzalloc include/linux/slab.h:666 [inline] kobject_create lib/kobject.c:783 [inline] kobject_create_and_add+0x42/0xb0 lib/kobject.c:809 add_partition+0x989/0xd80 block/partitions/core.c:443 bdev_add_partition+0xb6/0x130 block/partitions/core.c:518 blkpg_do_ioctl+0x2be/0x330 block/ioctl.c:52 blkpg_ioctl block/ioctl.c:69 [inline] blkdev_ioctl+0x58a/0x700 block/ioctl.c:589 block_ioctl+0xf9/0x140 fs/block_dev.c:1871 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 8459: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355 __kasan_slab_free+0xd8/0x120 mm/kasan/common.c:422 __cache_free mm/slab.c:3418 [inline] kfree+0x10e/0x2b0 mm/slab.c:3756 kobject_cleanup lib/kobject.c:704 [inline] kobject_release lib/kobject.c:735 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x171/0x270 lib/kobject.c:752 delete_partition+0x134/0x220 block/partitions/core.c:324 bdev_del_partition+0x18b/0x1d0 block/partitions/core.c:549 blkpg_do_ioctl+0x2d6/0x330 block/ioctl.c:33 blkpg_ioctl block/ioctl.c:69 [inline] blkdev_ioctl+0x58a/0x700 block/ioctl.c:589 block_ioctl+0xf9/0x140 fs/block_dev.c:1871 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Last call_rcu(): kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_record_aux_stack+0x82/0xb0 mm/kasan/generic.c:346 __call_rcu kernel/rcu/tree.c:2894 [inline] call_rcu+0x15e/0x7b0 kernel/rcu/tree.c:2968 tnode_free+0x99/0x100 net/ipv4/fib_trie.c:495 replace+0x134/0x470 net/ipv4/fib_trie.c:521 inflate net/ipv4/fib_trie.c:623 [inline] resize+0xeaf/0x1f80 net/ipv4/fib_trie.c:868 trie_rebalance net/ipv4/fib_trie.c:1059 [inline] fib_insert_node net/ipv4/fib_trie.c:1103 [inline] fib_insert_alias+0xaa2/0xd60 net/ipv4/fib_trie.c:1117 fib_table_insert+0x926/0x1af0 net/ipv4/fib_trie.c:1328 fib_magic+0x3b9/0x520 net/ipv4/fib_frontend.c:1084 fib_add_ifaddr+0x16c/0x520 net/ipv4/fib_frontend.c:1106 fib_inetaddr_event+0x162/0x29b net/ipv4/fib_frontend.c:1419 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83 __blocking_notifier_call_chain kernel/notifier.c:284 [inline] __blocking_notifier_call_chain kernel/notifier.c:271 [inline] blocking_notifier_call_chain kernel/notifier.c:295 [inline] blocking_notifier_call_chain+0x67/0x90 kernel/notifier.c:292 __inet_insert_ifa+0x914/0xc10 net/ipv4/devinet.c:553 inet_rtm_newaddr+0xccb/0x1330 net/ipv4/devinet.c:957 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5563 netlink_rcv_skb+0x15a/0x430 net/netlink/af_netlink.c:2470 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:671 __sys_sendto+0x21c/0x320 net/socket.c:1992 __do_sys_sendto net/socket.c:2004 [inline] __se_sys_sendto net/socket.c:2000 [inline] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:2000 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff88809e1ce600 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 60 bytes inside of 64-byte region [ffff88809e1ce600, ffff88809e1ce640) The buggy address belongs to the page: page:0000000095bffae7 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9e1ce flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea0002749388 ffffea00023ea488 ffff8880aa040200 raw: 0000000000000000 ffff88809e1ce000 0000000100000020 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809e1ce500: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ffff88809e1ce580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff88809e1ce600: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff88809e1ce680: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88809e1ce700: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================